PT-2020-15024 · Untangle · Untangle Ng Firewall

Harold Luiz Palazzini Cardozo · Published 2020-11-12 · Updated 2021-07-21 · CVE-2020-17494

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Untangle Firewall NG versions prior to 16.0

Description The issue concerns the use of MD5 for password storage in Untangle Firewall NG. This can potentially lead to security risks due to the weaknesses in the MD5 hashing algorithm.

Recommendations For versions prior to 16.0, update to version 16.0 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive areas of the firewall until the update can be applied.

Fix

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

Related Identifiers

CVE-2020-17494

Affected Products

Untangle Ng Firewall

References · 8

• https://github.com/untangle/ngfw_src/blob/1d232efe2c17a8838b59bbbeaf166dafa94676af/uvm/hier/usr/share/untangle/web/auth/index.py#L196-L200 · Patch
• https://github.com/untangle/ngfw_src/search?q=author%3Abmastbergen+committer-date%3A2020-08-10&type=commits · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2020-17494 · Security Note
• https://osv.dev/vulnerability/CVE-2020-17494 · Vendor Advisory
• https://wiki.untangle.com/index.php/16.0.0_-_16.0.1_Changelog · Note
• https://t.me/cvenotify/6177 · Telegram Post
• https://pastebin.com/s7UYG3vX · Note
• https://t.me/cibsecurity/16280 · Telegram Post